CVE-2022-23943: vulnerability in Apache HTTP Server
mod_sed: Read/write beyond bounds
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Apache's mod_sed module allows attackers to write data beyond the intended memory boundaries, potentially corrupting the server's memory and causing it to crash or behave unpredictably.
An out-of-bounds write vulnerability in mod_sed permits an attacker to overwrite heap memory via a crafted request, exploiting improper bounds checking in the sed stream editor module. The vulnerability affects Apache HTTP Server versions 2.4.52 and earlier; successful exploitation may lead to denial of service or arbitrary code execution depending on memory layout and attacker control over written data.
In the same product, most dangerous first.